Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2022 22:03
Static task
static1
Behavioral task
behavioral1
Sample
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe
Resource
win10v2004-20220812-en
General
-
Target
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe
-
Size
75KB
-
MD5
51e44f83dadd7c650626bc3fc0b023a0
-
SHA1
980f7e510752177589f73820ebe8a44dceff9210
-
SHA256
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea
-
SHA512
d908f4a841b11b4b2366bf0c7293c6a6439cda8e531f37e5243ded0070f7000eb12ccaab6974d863992acddb22c50b336b8892dc2199c4940e3db4f6c43838f0
-
SSDEEP
1536:PNQQMr5TScbEjtsAJ2kSCCRbIL5A8skarPToftGD4W:P7o2cbkyAJ2kObINvabx4W
Malware Config
Extracted
njrat
0.6.4
HacKed
savioanon.no-ip.biz:1971
693c40e8f5f059f9726e9dc4e4bdd32f
-
reg_key
693c40e8f5f059f9726e9dc4e4bdd32f
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
%temp%.exeanon.exepid process 996 %temp%.exe 1724 anon.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe%temp%.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation %temp%.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
anon.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\693c40e8f5f059f9726e9dc4e4bdd32f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\anon.exe\" .." anon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\693c40e8f5f059f9726e9dc4e4bdd32f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\anon.exe\" .." anon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exeanon.exepid process 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe 1724 anon.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exeanon.exedescription pid process Token: SeDebugPrivilege 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe Token: SeDebugPrivilege 1724 anon.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe%temp%.exeanon.exedescription pid process target process PID 4336 wrote to memory of 1860 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe svhost.exe PID 4336 wrote to memory of 1860 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe svhost.exe PID 4336 wrote to memory of 1860 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe svhost.exe PID 4336 wrote to memory of 528 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe svhost.exe PID 4336 wrote to memory of 528 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe svhost.exe PID 4336 wrote to memory of 528 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe svhost.exe PID 4336 wrote to memory of 996 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe %temp%.exe PID 4336 wrote to memory of 996 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe %temp%.exe PID 4336 wrote to memory of 996 4336 ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe %temp%.exe PID 996 wrote to memory of 1724 996 %temp%.exe anon.exe PID 996 wrote to memory of 1724 996 %temp%.exe anon.exe PID 996 wrote to memory of 1724 996 %temp%.exe anon.exe PID 1724 wrote to memory of 4084 1724 anon.exe netsh.exe PID 1724 wrote to memory of 4084 1724 anon.exe netsh.exe PID 1724 wrote to memory of 4084 1724 anon.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe"C:\Users\Admin\AppData\Local\Temp\ee72a51968c88152c144786716cae7acca6b9fac0b20fbaf8c680ce432b6efea.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\svhost.exeC:\Windows\Temp\svhost.exe2⤵
-
C:\Windows\Temp\svhost.exeC:\Windows\Temp\svhost.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\%temp%.exe"C:\Users\Admin\AppData\Local\Temp\%temp%.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\anon.exe"C:\Users\Admin\AppData\Local\Temp\anon.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\anon.exe" "anon.exe" ENABLE4⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\%temp%.exeFilesize
29KB
MD568111dfc1e5ceb7ace500209f229aac8
SHA12fed1646bcf410580c6b666561464af495f0e4bb
SHA256cf5dc6d712d2e57a72829ad3a44ee97dd81fc78874e74c925947009c391e008e
SHA51251c4ceb33ee7c51c2302204cdcaaf04a9120c56a96a45f9b4916fd5685bc2386c8d0c706d47497ecdfb7fce0ab6ec1e0fe605ea6f1badeb16485ed54ee5ed71e
-
C:\Users\Admin\AppData\Local\Temp\%temp%.exeFilesize
29KB
MD568111dfc1e5ceb7ace500209f229aac8
SHA12fed1646bcf410580c6b666561464af495f0e4bb
SHA256cf5dc6d712d2e57a72829ad3a44ee97dd81fc78874e74c925947009c391e008e
SHA51251c4ceb33ee7c51c2302204cdcaaf04a9120c56a96a45f9b4916fd5685bc2386c8d0c706d47497ecdfb7fce0ab6ec1e0fe605ea6f1badeb16485ed54ee5ed71e
-
C:\Users\Admin\AppData\Local\Temp\anon.exeFilesize
29KB
MD568111dfc1e5ceb7ace500209f229aac8
SHA12fed1646bcf410580c6b666561464af495f0e4bb
SHA256cf5dc6d712d2e57a72829ad3a44ee97dd81fc78874e74c925947009c391e008e
SHA51251c4ceb33ee7c51c2302204cdcaaf04a9120c56a96a45f9b4916fd5685bc2386c8d0c706d47497ecdfb7fce0ab6ec1e0fe605ea6f1badeb16485ed54ee5ed71e
-
C:\Users\Admin\AppData\Local\Temp\anon.exeFilesize
29KB
MD568111dfc1e5ceb7ace500209f229aac8
SHA12fed1646bcf410580c6b666561464af495f0e4bb
SHA256cf5dc6d712d2e57a72829ad3a44ee97dd81fc78874e74c925947009c391e008e
SHA51251c4ceb33ee7c51c2302204cdcaaf04a9120c56a96a45f9b4916fd5685bc2386c8d0c706d47497ecdfb7fce0ab6ec1e0fe605ea6f1badeb16485ed54ee5ed71e
-
memory/996-133-0x0000000000000000-mapping.dmp
-
memory/996-136-0x0000000074E30000-0x00000000753E1000-memory.dmpFilesize
5.7MB
-
memory/996-140-0x0000000074E30000-0x00000000753E1000-memory.dmpFilesize
5.7MB
-
memory/1724-137-0x0000000000000000-mapping.dmp
-
memory/1724-142-0x0000000074E30000-0x00000000753E1000-memory.dmpFilesize
5.7MB
-
memory/1724-143-0x0000000074E30000-0x00000000753E1000-memory.dmpFilesize
5.7MB
-
memory/4084-141-0x0000000000000000-mapping.dmp
-
memory/4336-132-0x00007FF812F20000-0x00007FF813956000-memory.dmpFilesize
10.2MB